In Case You Missed It:  The Gray Area of Ransomware Negotiations, Two Good Guys Turned Bad, Anthropic and Microsoft MCP Server Flaws Raise Security Concerns

Last week, the news included flaws that were revealed in MCP Servers from Anthropic and Microsoft, raising security concerns, and a pair of cybersecurity pros pleaded guilty to orchestrating ransomware attacks while fintech Enovo agreed to acquire Grasshopper Bank.

Ransomware Negotiations: Necessary But Risky

Ransomware negotiations are little talked about and remain a gray area in cybersecurity. While many in the cybersecurity industry note that it is often necessary to deal with cybercriminals who have penetrated organizations’ and hold their assets hostage, negotiators must tread carefully so they don’t cross a line between rescuing a company and providing the funding for criminals to continue their nefarious acts. And there is always the risk that the bad actors won’t honor terms of an agreement. There are no set rules or processes for brokering deals—and some companies like CrowdStrike paying ransomware demands is a hard no—and details of negotiations are rarely shared for obvious reasons. But many of those involved in making deals for the release of data and assets believe that if negotiation data could be collected and anonymized it could help in future negotiations without exposing victimized companies.

Anthropic, Microsoft MCP Server Flaws Ratchet Up MCP Security Woes

Anthropic and Microsoft both disclosed vulnerabilities in MCP servers last week, underscoring mounting security issues surrounding the MCP protocol, pioneered by Anthropic that has become key as agentic AI proliferates. The three vulnerabilities in Anthropic’s Git MCP server were uncovered by security researchers at Cyata—and can be exploited via prompt injection attacks and used together can create a remote code execution exploit. A server-side request forgery (SSRF) vulnerability in Microsoft’s MarkItDown MCP server found by BlueRock Security ultimately allows bad actors to access http or file resources. MCP security concerns have surged more recently with experts like Joshua Scott, CISO and vice president of security at Hydrolix, noting there is no "S" in MCP but there should be.

Exposed Database Contains Millions of Account Credentials from Social Media, Email, Financial

It's a familiar refrain—millions of login credentials exposed on the internet. This time the number is pretty impressive, 149 million credentials, from notable accounts, including Facebook, Gmail, WordPress, DisneyPlus, TikTok, crypto wallets, trading accounts, and banking logins. Experts say the credentials likely came from infostealer malware, though it contained hostname in a reversed format and a line hash identifying each record, typically not seen in other infostealer datasets.

Cybersecurity Experts Turned Extortionists: Inside the BlackCat Betrayal

In the convoluted narrative of cybercrime, 2025 delivered a plot twist worthy of a thriller. Two cybersecurity professionals, those once charged with protecting sensitive systems, pleaded guilty this week to orchestrating ransomware attacks that netted millions in damage and triggered one of the most significant insider threat cases in recent memory.  Ryan Goldberg and Kevin Martin weren’t shadowy hackers from overseas. They were insiders: trained, credentialed, and trusted. These two ex-cyber professionals turned rogue, weaponizing their skills and insider knowledge to deploy the notorious BlackCat ransomware (also known as ALPHV) against five U.S. businesses, including a medical device maker, a pharmaceutical firm, and a drone technology company. The case reveals how specialized knowledge used to protect systems can be parlayed into calculated destruction and profit. The fallout reaches beyond the financial losses of individual victims, exposing deeper vulnerabilities in how we conceptualize insider risk, ransomware economics, and the sophistication of modern cyber extortion.

US Fintech Enova International Acquires Fully Licensed National Bank

Enova International’s agreement to acquire Grasshopper Bank, including its fully licensed national bank subsidiary, for approximately $369 million, is emblematic of a broader trend spanning the financial services and adjacent sectors where fintechs are moving to obtain banking charters, whether through application or acquisition, or expand their services and fortify trust with customers. Merger and acquisition activity continues to soar. Two-thirds of executives expect M&A momentum to continue or increase over the next 12 to 24 months, with 26 percent predicting a strong uptick, according to the Exploring M&A trends and challenges in banking study, fielded  in April 2025 by TechStudio™, an Energize Marketing® company, and FIS®. Regional and community banks are actively pursuing growth through M&A, with 56 percent hunting for targets and 12 percent preparing to be acquired. But this latest deal by Enova, which follows similar ones like LendingClub’s acquisition of Radius Bank in 2020 and SoFi’s acquisition of Golden Pacific Bank in 2022, marks a reverse of the traditional narrative: Instead of banks and traditional financial services institutions acquiring fintechs for their technology, now fintechs are buying banks for their regulatory status and funding advantages.